Performing Network Traffic Analysis with Zeek

Overview

Zeek (formerly Bro) is an open-source network analysis framework that operates as a passive network security monitor. Unlike traditional signature-based IDS tools, Zeek generates high-fidelity structured logs from observed network traffic, capturing detailed metadata for protocols including HTTP, DNS, TLS, SSH, SMTP, FTP, and dozens more. Zeek's extensible scripting language enables custom detection logic, behavioral analysis, and automated response. This skill covers deploying Zeek, understanding its log architecture, writing custom detection scripts, and integrating outputs with SIEM platforms.

When to Use

• When conducting security assessments that involve performing network traffic analysis with zeek
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Linux server (Ubuntu 22.04+ or CentOS 8+) with 4+ CPU cores and 8GB+ RAM
• Network TAP or SPAN port mirroring configured for traffic capture
• Zeek 6.0+ installed (via package manager or source compilation)
• Root or capture group privileges for packet capture
• SIEM platform (Splunk, ELK Stack, or QRadar) for log ingestion

Core Concepts

Zeek Architecture

Zeek operates in two main modes:

1. Live Capture - Monitors traffic in real-time on one or more network interfaces
2. Offline Analysis - Processes saved PCAP files for retrospective analysis

The processing pipeline consists of:

• Packet Capture Layer - Reads raw packets from interfaces or PCAP files
• Event Engine - Reassembles TCP streams and generates protocol events
• Script Interpreter - Executes Zeek scripts that process events and generate logs
• Log Framework - Writes structured logs in TSV, JSON, or custom formats

Log Architecture

Zeek generates protocol-specific log files:

Workflow

Step 1: Install and Configure Zeek

# Install Zeek on Ubuntu
sudo apt-get install -y zeek

# Or install from Zeek repository
echo 'deb http://download.opensuse.org/repositories/security:/zeek/xUbuntu_22.04/ /' | \
    sudo tee /etc/apt/sources.list.d/zeek.list
sudo apt-get update && sudo apt-get install -y zeek-lts

# Verify installation
zeek --version

Configure the node layout in /opt/zeek/etc/node.cfg:

[manager]
type=manager
host=localhost

[proxy-1]
type=proxy
host=localhost

[worker-1]
type=worker
host=localhost
interface=eth0
lb_method=pf_ring
lb_procs=4

[worker-2]
type=worker
host=localhost
interface=eth1
lb_method=pf_ring
lb_procs=4

Configure network definitions in /opt/zeek/etc/networks.cfg:

# Internal network ranges
10.0.0.0/8         Private RFC1918
172.16.0.0/12      Private RFC1918
192.168.0.0/16     Private RFC1918

Step 2: Configure Logging and Output

Edit /opt/zeek/share/zeek/site/local.zeek:

# Load standard detection scripts
@load base/protocols/conn
@load base/protocols/dns
@load base/protocols/http
@load base/protocols/ssl
@load base/protocols/ssh
@load base/protocols/smtp
@load base/protocols/ftp

# Load file analysis
@load base/files/hash-all-files
@load base/files/extract-all-files

# Load detection frameworks
@load base/frameworks/notice
@load base/frameworks/intel
@load base/frameworks/files
@load base/frameworks/software

# Load additional protocol analyzers
@load policy/protocols/ssl/validate-certs
@load policy/protocols/ssl/log-hostcerts-only
@load policy/protocols/ssh/detect-bruteforcing

…